LEGAL
Privacy
Last updated 2 October 2026
This notice explains what OmniSchema collects and why. It applies to the product at omnischema.app and related site addresses, and to the OmniSchema Android app.
Who we are
OmniSchema is provided by Soraflex Technologies Ltd, registered in England and Wales, company number 17485483. Registered office: 37 Roberts Avenue, Conisbrough, Doncaster, DN12 2DB. For the account details we hold about you, Soraflex Technologies Ltd is the data controller. For the business data a company stores in its workspace, that company is the controller and we process it on its behalf. We are registered with the Information Commissioner's Office (ICO), registration number ZC260597.
What we collect
- Account details you give us: name, email, company name, role, site assignment.
- Business data you store in lists, pages, files, and messages.
- Technical logs needed to run the service: sign-in time, IP address used at sign-in, security events.
- Billing details processed by Stripe. We do not store full card numbers.
- Location on jobs: where a job was started and closed, recorded only at the moment the person doing the job presses Start or Close, and only if their phone or browser has been allowed to share location (it asks them first; saying no doesn't stop the job). It is not tracked at any other time.
- Phone numbers and text messages a company sends to its own customers or staff.
How we use it
To provide the product, enforce plan limits, send account emails such as password resets, detect abuse, and meet legal duties. We do not sell customer data.
Who sees it
People you invite to your company, with the access you give them. OmniSchema infrastructure administrators use a separate, restricted environment and do not use ordinary customer accounts to browse customer data.
Services that help run OmniSchema
These companies process data for us, and only what they need for the job:
- Hetzner (Germany): runs our servers and database.
- Amazon Web Services (Sweden): stores files and images you upload.
- Stripe (Ireland and the United States): plan payments.
- Resend (United States): sends account and notification emails.
- Sentry (Germany): error reports, so we can fix problems.
- Anthropic (United States): answers questions in the in-app assistant, using only what the person asking can already see. It is not used to train AI models.
- Stripe Connect: if a company takes card payments, its customers pay on Stripe's page and the money goes to that company's own Stripe account.
- Xero or Intuit QuickBooks: if a company connects its accounts, the invoices and customer names it chooses to send go to that company's own Xero or QuickBooks.
- Twilio (United States): delivers text messages.
- MapTiler (Switzerland): map images for the jobs map. Your browser asks MapTiler for map tiles, so MapTiler sees your IP address, not your jobs.
Where data goes outside the UK, we rely on the UK's adequacy rules or standard contractual clauses to protect it.
Retention
Account and business data stays until you delete it or close the company. Soft-deleted items are kept up to 30 days, then removed. Security logs are kept to investigate incidents.
Your rights
You can ask to access, correct, or delete personal data we hold, or export list data from the product. Contact privacy@omnischema.app. If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk.
Cookies
We use a signed, HttpOnly session cookie to keep you signed in, and a CSRF cookie to protect forms. We do not use advertising cookies.